ABSTRACT OF THE DISCLOSURE 

An unauthorized access detection device capable of 
detecting unauthorized accesses which are made through 
5 preparation, in real time. When a packet travels on a 
network, a key data extractor obtains the packet and 
obtains key data. Next an ongoing scenario detector 
searches an ongoing scenario storage unit for an ongoing 
scenario with the key data as search keys . A check unit 

10 determines whether the execution of the process indicated 
by the packet after the ongoing scenario detected by the 
ongoing scenario detector follows an unauthorized access 
scenario being stored in an unauthorized access scenario 
storage unit. Then a report output unit outputs an 

15 unauthorized access report depending on the check result 
of the check unit. 
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